| target | Path or image reference to scan. | no | . |
| type | Target type: image | repo | k8s (inferred from the target if empty). | no | "" |
| scanners | Comma-separated scanners to run (default: all that support the target). | no | "" |
| format | Output format: sarif | json | xml. | no | sarif |
| output | Report file, relative to the working directory (empty = stdout). | no | quorum.sarif |
| fail-on | Exit non-zero if any finding is >= this severity: critical|high|medium|low. | no | "" |
| min-severity | Drop findings below this severity from the report and gating. | no | "" |
| baseline | Baseline file of fingerprints/correlationKeys to suppress. | no | "" |
| crosswalk | Crosswalk mapping directory (defaults to the one bundled in the image). | no | /opt/quorum/crosswalk |
| timeout | Per-scanner timeout (e.g. 5m). | no | "" |
| offline | Disable OSV alias lookups (scanner-local aliases + cache only). | no | false |
| quiet | Suppress progress logs on stderr. | no | false |
| image | Quorum image to run. Pin by @sha256:... in production. | no | ghcr.io/martinez1991/quorum-sec-scan:full |
| verify | Cosign-verify the image signature (keyless OIDC) before running it. | no | true |
| working-directory | Directory mounted into the scanner as /work. | no | ${{ github.workspace }} |
| docker-socket | Mount the host Docker socket (/var/run/docker.sock) so scanners can read images from the runner's Docker daemon (e.g. a just-built image). It is auto-mounted for `type: image` — set "true" to force it for other types, or "off" to opt out even for image scans. | no | "" |
| trivy-args | Extra CLI args appended to trivy (QUORUM_TRIVY_ARGS). | no | "" |
| grype-args | Extra CLI args appended to grype (QUORUM_GRYPE_ARGS). | no | "" |
| checkov-args | Extra CLI args appended to checkov (QUORUM_CHECKOV_ARGS) — e.g. "--bc-api-key <key> --repo-id org/repo --framework terraform,secrets" to unlock Prisma Cloud/Bridgecrew policies through the bundled OSS Checkov. | no | "" |
| kics-args | Extra CLI args appended to kics (QUORUM_KICS_ARGS). | no | "" |
| dockle-args | Extra CLI args appended to dockle (QUORUM_DOCKLE_ARGS). | no | "" |
| kubescape-args | Extra CLI args appended to kubescape (QUORUM_KUBESCAPE_ARGS). | no | "" |
| advice | Attach the advisory layer: deterministic remediation templates + OWASP references (Phase 0) and RAG retrieval from the bundled digest-pinned OWASP corpus (Phase 2, lexical — no model). Set "true" to enable. | no | false |
| advice-provider | AI recommendation provider (Phase 1): none | local. "local" queries an on-host OpenAI-compatible endpoint (e.g. Ollama) for a labeled, advisory recommendation per finding. Requires `advice: true` and a reachable model. | no | none |
| advice-endpoint | OpenAI-compatible base URL for advice-provider=local. Defaults to host.docker.internal so the scanner container can reach a model running on the runner host (the action adds the host-gateway mapping automatically). | no | http://host.docker.internal:11434/v1 |
| advice-model | Model id for advice-provider=local (e.g. qwen2.5-coder:7b). | no | "" |
| advice-embed-model | Embedding model for SEMANTIC OWASP retrieval (only when the corpus ships vectors). | no | "" |
| advice-max | Max findings sent to the AI provider per run (0 = no cap). | no | "" |
| advice-cache | Path (relative to working-directory) for the AI advice cache, so repeated runs reuse a finding's recommendation instead of re-querying the model. Put it under the workspace (e.g. .quorum/advice.json) and persist it with actions/cache for reproducibility across runs. | no | "" |
| fix | AI suggested-fix mode (Phase 1): off | suggest. "suggest" emits a patch that passed a verify-the-fix re-scan; it is NEVER auto-applied. Requires advice-provider=local (remote refuses --fix — it would upload source). Scope: IaC/K8s targets. | no | "" |
| advice-allow-egress | Consent to send findings off-host — REQUIRED for advice-provider=remote, which posts finding titles/paths/controls to an external API. Set "true". | no | false |
| advice-api-key | API key for advice-provider=remote (pass a repository/organization secret). Forwarded to the scanner as QUORUM_ADVICE_API_KEY and never logged. Blocked under offline. | no | "" |